Sobig 'Carpet Bombs' the Internet - Page 2

 By Sharon Gaudin
Page 2 of 2   |  Back to Page 1
Print Article

The Fastest Spreading Virus in History

Sobig-F is now being called the fastest spreading virus in the industry's history.

"It was a carpet bombing," says Sophos Inc.'s Chris Belthoff. "We're judging this to be the fastest spreading worm ever, even surpassing Klez and LoveBug. This is really just a complete swamping, or inundation, of networks...Companies are having their email systems taken down because of the sheer volume of emails they're getting. It's a slow down, then a slow to a crawl and then just being taken offline."

Sobig-F, which first appeared this past Monday as the latest member of the malicious Sobig virus family, hit the Internet hard, flooding email servers and inboxes. Corporate networks staggered under the barrage with network access slowing to a crawl and some email systems temporarily taken off-line to stop the siege.

AOL saw email traffic nearly quadruple yesterday, according to Nicholas Graham, an AOL spokesman. Graham says AOL scans email attachments at the gateway, checking for viruses. On an average day, the ISP scans approximately 11 million attachments. On Wednesday, the staff scanned 40.5 million email attachments and found 23.7 million of those to be infected with viruses. Almost all (23.2 million) of the infected attachments were a result of Sobig-F.

"People are just getting pummeled, either with the virus or with non-delivery notifications," says MJ Shoer, president and chief technology officer of Jenaly Technology Group, Inc., an IT provider and consultant based in Portsmouth, N.H. "We're just getting beaten on. One of our clients is seeing a 90 percent increase in email messages. In the case of my mailbox, it's close to 70 percent. And I have a firewall, a spam and content filter, and anti-virus."

And Shoer reports the virus attack is bringing regular work to a standstill. "It's rendered IT staffs useless. They're just flooded. If there was going to be a rollout or something, it's just not getting done. We're putting off everything that was a high priority."

Shoer also noted that he talked to an IBM engineer on Wednesday who wasn't able to offer him customer service because his own email was down. Security analysts verified IBM's troubles, but the company could not be reached for comment, and its Web site was unresponsive Wednesday afternoon.

"A lot of corporations and universities had to literally shut down their email networks because of the huge volume of traffic of inbound Sobig emails and bounced email messages," reports Central Command's Steve Sundermeier. "If you're talking about a large corporation – a Fortune 100 or a Fortune 200 – and you take down an email system for an hour, it could cost that corporation a million dollars."

But three different security experts say the Sobig-F assault seems to have peaked yesterday afternoon, when the malicious email was accounting for at least 70 percent of all email flowing around the world. Today, while the number is still high, most estimates have it dropping down into the 60 percent to 70 percent range.

Sophos Inc.'s Belthoff says the virus, which is a mass-mailing worm that also can spread via network shares, hit the Net so hard so quickly because of the spam-like spreading technique that the author used.

"They carpet bombed the Internet and played the numbers game," says Belthoff. "There were just millions of copies out there hitting the Internet all at the same time. It's a matter of sending out enough copies so that somebody will click on it. When you send out that many, even a small percentage of a response, is going to make for a successful virus."

Other security analysts say the virus is also hitting the Internet so hard because it is building on the impact of its Sobig predecessors.

Sundermeier explains that earlier variants of Sobig have infected computers and then downloaded Trojans to set the machines up to be hidden proxy servers. "The author has a huge army now for the next seeding," he says. "Every Sobig variant becomes bigger and bigger, and we believe it's because of this army he's building of infected machines."

Sobig-F is designed to die out on Sep. 10. That's leading many analysts to suspect that the next variant will hit on Sep. 11 or soon after. And if that variant builds on the malicious success of Sobig-F, then the damage could be even worse.

AOL's Graham says they are already planning defenses for the next Sobig attack. "We're already gearing up for the next variant, Sobig-G, if you will," he says.

Back to CrossNodes

This article was originally published on Aug 21, 2003
Get the Latest Scoop with Networking Update Newsletter